VIBE-CODED APP: 12 PRE-LAUNCH QUESTIONS
Ember Digital | emberdigital.com.au

Use this as a self-check, not a security certification. Test only accounts and data you own or are authorised to assess.

[ ] 1. Can user A ever fetch user B's records by changing request identifiers?
[ ] 2. Are RLS policies and database grants reviewed for every exposed Supabase table?
[ ] 3. Are privileged database and API keys absent from browser bundles and repository history?
[ ] 4. Have exposed secrets been rotated and potential misuse assessed?
[ ] 5. Does every sensitive route and Server Action check identity and permissions?
[ ] 6. Have unauthenticated, ordinary-user and admin roles been tested separately?
[ ] 7. Are payments confirmed using trusted server-side provider events?
[ ] 8. Can webhooks and jobs handle retries, duplicates and out-of-order execution?
[ ] 9. Are expensive API calls protected by limits, validation and monitoring?
[ ] 10. Are staging and production environments separated appropriately?
[ ] 11. Can critical data be restored and a faulty deployment rolled back?
[ ] 12. Do you know what personal data you collect, store, log, share and delete?

A blank answer shows what still needs verification. It does not, by itself, prove an app is insecure.
Read the full guide: https://www.emberdigital.com.au/insights/vibe-coded-app-launch-checklist